iovisor / iovisor/bcc

accessing bitfield for sk_protocol

Open
#270 6 comments 3 reactions 0 assignees View on GitHub
prio:low
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

I'm not sure bitfields work yet. sk_protocol is a bitfield. Trying to test it:

``` C
int kretprobe__inet_csk_accept(struct pt_regs *ctx)
{
struct sock *newsk = (struct sock *)ctx->ax;
u32 pid = bpf_get_current_pid_tgid();

if (newsk == NULL)
return 0;

// check this is TCP
if (newsk->sk_protocol != IPPROTO_TCP)
return 0;
[...]
```

gets:

``` Shell
bpf: Permission denied
0: (79) r6 = *(u64 *)(r1 +80)
1: (85) call 14
2: (15) if r6 == 0x0 goto pc+71
R0=inv R6=inv R10=fp
3: (61) r1 = *(u32 *)(r6 +328)
R6 invalid mem access 'inv'
```

I also tried:

``` C
u8 protocol = 0;
bpf_probe_read(&protocol, sizeof(protocol), &newsk->sk_protocol);
```

which gets:

``` Shell
:16:46: error: address of bit-field requested
bpf_probe_read(&protocol, sizeof(protocol), &newsk->sk_protocol);
^~~~~~~~~~~~~~~~~~~
1 error generated.
Traceback (most recent call last):
File "./tcpaccept", line 101, in
b = BPF(text=bpf_text)
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 349, in __init__
raise Exception("Failed to compile BPF module %s" % src_file)
Exception: Failed to compile BPF module
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the tcpaccept BPF snippet in the issue and reproduce both the verifier rejection and the compiler error for sk_protocol. The payload names no source files or tests, so trace how BCC handles kernel bitfields and probe reads. Done means the reported sk_protocol access works without these errors, with coverage for the reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.